ftaftd-Ciixp^a tion. 

I had- j-us£ joined Rand permanently in July of 1959, 
having spent the summer of ’58 there as a consultant. In 
the summer of '59 I chose as a focus of my research the 
command-control process for nuclear forces. This was a 
question which was coming to seem of increasing importance 
as people studied the process of the alerting of nuclear 
forces in the event of an oncoming nuclear attack and the 
implementation of an execute order by the President. 
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mo go -rfght to the^ fact that J,n the fall of '59, I moved 

CltfcPAc- fi-i 

to Camp Smithy ^ I did not agree to stay for the whole year 
since my wife was not willing to accompany me but I did go 
for several months at first and then went back repeatedly 
during 1960 to help them in later stages of their report. 

The basic problem we were to look at was how to assure the 
reliability of an "execute" message getting out to the 
various forces in the Pacific if a decision were ever made 
to use nuclear But there were many related questions. 

We had communications experts with us, of course, who were 
looking in particular at redundancy and reliability and speed 
in the communications system. Another problem that I was 
interested in was the unauthorized action problem: how to 
assure that no subordinate would be able to launch the 
forces under his command in the absence of an authorization 
from the President or from his superiors. A third problem 
was how to assure the survival of authority at various 
positions of command so that the whole command structure 
could not be put out of action by a coordinated surprise 
nuclear attack. ^To this end, for example, a command post 
in Hawaii was located in an underground command center. 

It had been originally an ammunition storage depot, built 
under a pineapple field in Hawaii during the Second World 


In the end, in pursuit of this problem, I was in a-l+tof-h 
every command post and in particular every underground 

rifT - -- * -- —- 13 -* -J . p # 
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Genwraird post in the U.S, and in the Pacific, of which there 
«Fe—quite—a few. For example the command post in Japan itself 
was in what haA formerly been the Japanese Imperial Command 
Post, which was in the outskirts of a suburb of Tokyo. But 
all of these underground command posts had been built 
essentially against conventional bombs and as a result very 
little attention had been given, in particular, to blast 
doors .-"'H The blast of a nuclear explosion would be so great 
that if it were anywhere in the vicinity of one of these 
undergrounds it would blow through any ordinary security 
door and kill everyone inside. In other words, it is not 
enough that you have protection from a direct hit over your 
heads from a small bomb or even from a very large bomb, but 
every aperture letting in ventilation, letting out communicat¬ 
ion, and allowing for doors, had to be equally secure against 
blast pressure or the thing was entirely worthless. These 

r 

doors, were a very important practical problem, not entirely 
easy to solve. p Even when you did that, if you were to operate 
from there you had to assure that you would be able to 
communicate out even after explosions; and a relatively late 
problem we discovered in the course of testing was that the 
blast, by shaking up all the electronic equipment inside could 
easily destroy the functioning of all of your radios, trans¬ 
mitters, etc. even though it did not kill anyone. So we had 
•a 

■ftidr—these. problems with decreasing the vulnerability of both 
the communications and the commanders themselves. 
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Remember that from very early on, indeed, by the 


time of the Atomic Energy Act by Congress, the President 

I n princ* 

alone^ controlled the use of all nuclear weapons and 
authorized the use of nuclear weapons. This is one 
tactical military decision which is Statute and by certain 
Presidential directives, reflected in the written war plans, 
limited to the authority of the President alone. The same 
applies to a few other weapons like bacteriological weapons 
or gas, in terms of plans. 



Meanwhile, it was generally recognized within the 
Air Force that there was a severe problem of communications 
and of survival of command. In their extreme focus on 
being able to carry out their mission of exploding nuclear 
weapons over Russian targets when appropriate, a great many 
other problems, such as - not exploding them when not appropriate, 
were deemphasized,' particularly in the light of the fact that 
there was a high likelihood, much greater than presidents were 
likely to realize, that communications could be disrupted. 

You had, in other words, a command structure which 

, , C*\\ 

presumed that only a president could a d: low for the firing 

of nuclear weapons. At the same time you had an awareness 
by most of the military people down the chain that the 
president himself could easily be killed by a bomb on 
Washington and in fact most intervening levels of command 
could easily be wiped out by only a few more bombs. They 
lived with what was for them a nightmare: that in the event 
of actual attack there was no likelihood that an authorized 
command would reach the actual operating level of the nuclear 
delivery forces. Fr— e-£4eci there was great resistance on 
their part to the very idea of procedures that would make 
it physically impossible for those lower levels to take 
action on their own in the event of an actual war. At the 
same time, of course, they knew that they had always to 
give lip service to the assumption that only the President 
could "release these weapons." The effect of this was that 
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they chose not to look closely at the system that really 
resulted, which left enormous leeway, in fact almost 
untrammeled opportunity, for individuals to carry out 
unauthorized action. 

I had become possibly the most knowledgable person 
in the country on the processes of this control system by 
the time that the freaks Fail - safe , Seven Days in May and 
br. Strangelove appeared. Strangelove is actually based 
on a book called Red Alert and Fail-safe was by William 
Burdick. What I had discovered was that the problem in 
Burdick's "Fail Safe" - w«-s a mechanical, electronic 
failure by a computer transmitting an improper direction - 
was actually very unlikely inasmuch as there were many 
levels of human intervention at various points and the 
system was not set up mechanically to transmit things 
like that. But then on the other hand the Red Alert or 
Strangelov e problem - where a base commander took it on 
himself to launch his planes deliberately - was a very 
real problem and was*in no way physically ruled out. In 
fact from my work as early as the summer of '58 at Rand I 
had become aware of the many opportunities and possibilities 
where even an honest misunderstanding of a situation by a 
lower commander might lead him to believe that it was his 
duty to carry out such an attack -- that the moment had 
arrived. (See my memo on this). This is the sort of thing 
that I set out to focus on in the Pacific. 
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Our CINCPAC study group visited, among other places, a US£F 

base at Kadena, Okinawa, where a dozen or so F-100's were on 

ten-minute strip alert. The pilots were allowed to leave the 
strip for errands, while they were on alert duty, because they 
were each accompanied by a jeep and driver and an alert drill was 
practiced at least once a day. In fact, to demonstrate their 
capability the officer in charge offered to let us pick the time 
to call an alert during our visit, which we did. Klaxons went off 
everywhere within hearing, jeeps began converging on the strip 
within minutes and pilots were scrambling into their planes while 
we watched the clock. Amazingly enough, the engines were gunning 
and the planes were ready to takeoff in less than ten minutes: 
a stunning performance. 

They did not, however, either taxi to the end of the runway 
or actually take off in such alerts--as SAC planes frequently did, 
or as certain other types of tactical fighter bombers did—because, 
it was explained to us, the 1.1 megaton thermonuclear bombs (each- 
one more than 50 times the explosive power of the Nagasaki weapon) 
that hung underneath the planes were somewhat obsolescent weapons. 

They were not "sealed pit" weapons, they were basically designed to 
be carried inside a plane, not slung underneath, and they were 
"not 3-point-safe." § 3-point-safe, which was characteristic of 
the newer weapons,meant that if three sections of the high explosives 
that surrounded the fission core--which in turn was to set off the 
thermonuclear material—went off accidentally, the result should not be a 
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nuclear explosion, but if more than three went off it might 

explode, have a partial explosion or a total explosion. 

ftere o/der 

That meant in other words that if were dropped A fek»t one 

^ Or Sor/ted ) 

or two sections of the high explosive going off might 

result in a partial or total explosion*and this risk while 

A t / 

small^was not worth taking in an alert^which after all 
happened once a day, a full-scale alert which involved 
pilots actually jumping into planes and gunning up their 
motors. But they did not go to the point of going down 
the runway^ because of the danger of an accident 

in which one might go off. 

I had been concerned at Rand with the false alarm 

problem. This led in my mind immediately to the questionj 

e, 

supposing some day there was not an alert but a false 
alarm sufficient to cause these planes to execute their 
emergency plan, short of an execute order. This called 
for these planes actually to take off and to circle in 
rendezvous areas until they received an execute order. 

If they did not receive it, they were eventually to re- 

-fKe- -f*it ConCe^j"* 

turn to base*. A The takeoff was simply for their physical 
protection lest they be caught above ground by a nuclear 
attack. This might result either from an alerting order 
from Washington, or more likely from some theater command, 
concerning danger of some sort, and of course it would 
result p r obably, if a nuclear weapon went off anywhere in 
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the theater. There would be sufficient expectation that 
a nuclear attack was underway as to cause most commanders 
to tell their subordinate commanders to execute at least 
protective launch. In theory again, remember, there was to 

i\ ii 

be no execute unless they received a positive order to go 
ahead. This is the essence of what is known as the fail¬ 
safe procedure. No plan allowed them, without an execute 
order, to decide for themselves to go ahead and execute. 
Only if they received an authenticated message that had 

certain passwords - characteristics that indicated that it 

,. , , , w*«-e Hey 

came directly from the President - wa-s—s4: 'to go towards 

target. 

The problem that I discovered was that this was a 

■Qor 

process that could be set in motion, be one thing, by a 
nuclear blast anywhere in the area; but there was the 
additional problem that once a blast went off anywhere 
in the area there were several other effects on expectat- 

Icno^lc-d^e. of 

ion. For one,^that very fact would almost certainly 
convince most people that a nuclear attack was underv/ay, 
subjectively,.whether or not they had received an execute 
order. Second, if they were launched for any reason at 
all - such as a blast in some other theater, like the 
European theater, or intelligence warning - a subsequent 
blast then had a distinctly higher likelihood than earlier, 
by the very fact that these planes were now taxiing and 
taking off. It was in recognition of that danger that 
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they were forbidden to take off under normal alerting or 
practice procedures. So that meant that if you had a 
blast anywhere in the world'or had other reason to expect 
an attack, a nuclear weapon had some significant likelihood 
of going off accidentally in the next few minutes somewhere 
in the world on an alert strip. 

A third result was that that fast-alert blast in 
itself would almost certainly disrupt all communications with¬ 
in the area. Certainly it would destroy all transmitting 
points in the vicinity of the base, but moreover, the 
electronic affects of the blast itself would probably dis¬ 
rupt all high frequency communications in that area. That 
meant that the last message that any other bases in the 
area would receive,for a period, would be that a blast had 
just occurred and they would then find themselves out of 
communications locally; just after, perhaps, a message putting 
them on an extraordinary of alert, requiring them for 

k 

the first time actually to take off. Fourth the very fact 
that they had gotten to the point of actually launching 
would be a first for any of those pilots and would itself 
subjectively ihake them almost certain that an attack was 
underway. 

All of this added up to the likelihood that a high 
level false alarm anywhere in the world was considerably 
likely to generate the belief in the minds of some airborne 
pilots armed with megaton weapons that although they had 
not received an execute order^ general nuclear war had already 
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So the fact was, in other v/ords, that the secrecy system 
was being used - for reasons almost entirely of agency 
pride - to protect a totally irrational arrangement which 
had the most horrendous possible diplomatic implications, 
and it was out of the effective control of the President 
of the United States, let alone the Congress. 

Exposing this to Congress would have immediately 
raised the secrecy question, even to someone on the Hill 
with a clearance who dealt with such matters. It would 

V 

have been treated as the exposure of an extremely 
"sensitive" secret. And it was. Remember, what is a 
"sensitive secret?" It w^s- a secret like My Lai. It is 
hard to say that My Lai was not a genuine secret, in the 
sense that exposure of it had the potential of "damage to 
the United States." The exposure of any egregious violation 
does. 

In summary, we see a function of Rand here, in the 
ability of Rand analysts and consultants to cross bureau¬ 
cratic lines, to become aware of information concealed 
by one agency from another, or by all agencies from higher 
levels of authority, who were authorized to know it but had 
been deliberately deceived about this information. We have 
the incident of information stamped and intended only for 
one recipient within the system, the Assistant Secretary of 
Defense, immediately being leaked internally; the copying 
of that document and delivering it to the CNO entirely 
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against DoD Regulations; xn other words, the regulations' 
are violated instantly and blatantly when that serves 
Service interests (of protecting a practice violating 
a U.S. treaty!) We have the- deliberate and direct deception 
of the Secretary of Defense and his Special Assistant, 
and the defiance of the-Secretary-by a lower agency of his 
directive to change the situation about which he had been 
deceived and about which he had been kept in ignorance by 
the protective secrecy system. We have also the in- 
hibitions of everyone in the system not only to go against 
bureaucratic resistances but to do so in violation of 
secrecy regulations which woirld-have made it difficult to 
go to Congress let alone to the press. Also we have the 
fact that what was a genuinely "sensitive 1 ' secret was so 
precisely because it involved a major violation of an 
international treaty by the United States. Indeed, if 
you ask what sorts of information could conform to the 

V » , 

definition of "top secret" as potentially leading to a 
direct breach in diplomatic relationships, obviously it 
would cover to a large extent major violations of our 
understandings or treaties with other countries. And 
the capability to keep such sensitive secrets is an 
encouragement to violate Congressionally-ratified treaties, 
without any accountability to Congress or the public< 



nuclear delivery system were aware iof the central problem 
of reliability, ^”1^960 and 1961,, which had to do with 
communications and with the vulnerability of command posts 
and commanders. The prime principle in the control of 
nuclear weapons, one that was written into the Atomic 
Energy Act itself, was that the use of nuclear weapons had 
to be controlled and authorized by the President personally. 
All written plans expressed that principle. The military, 
however, were very conscious that this posed the possibility 
that the President and virtually all of his legal successors 
could be destroyed by a single nuclear weapon on Washington, 
so that the system would be deprived of its control 
authority; if the strict letter of the law were followed, 
the entire system would be paralyzed. Even in a physical 
sense,' the destruction of a number of communications 
terminals such as the central command facilities both 
in Washington and in SAC Headquarters in Omaha and a hand¬ 
ful of others in the country, would make it close to 
impossible to get the word out to all world-wide nuclear 
forces, or even to forces within the country, either for 
an alert or to execute the general war plans. It gradually 
came to be recognized that this was a separate and almost 
more urgent problem than the vulnerability of the bases them¬ 
selves . 

In the '50's Rand, through the work of Albert 
Wohlst4.tter, /v Fred Hoffman, and Andrew Marshall, in their 
reports R-266 and R-290, which are now unclassified, the 
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Air Force and the President had become aware of the 
vulnerability of the bases and the vehicles themselves, 
since the bombers were Clustered on a relatively small 
number of bases which were highly vulnerable. This was 
a major concern of the Gaither Report in 1957, which 
was in large part based on briefings by analysts from 
Rand. It was not until 1959 and 1960, as that problem 
came under contro iVn part with the onset of Polaris 
forces and Minuteman\4hat it became realized that 
even if the vehicles survived worldwide, the system 
could be paralyzed by attacks on the communications 
centers and the commanders, which were small in number 
and also vulnerable. In principle, being smaller in 
number, these could be made less vulnerable, made hard¬ 
ened or mobile in various ways. But on the other hand, 
it was very difficult to harden a small number of points 
against a determined attack. This was the problem on 
which I specialized--the reliability, in various senses, 
of the command process. I picked this problem partly 
because it had just been recognized as urgent about the 
time I came to Rand, and partly because I was drawn to 
it intellectually from my long interest in the decision¬ 
making process under uncertainty. 

In fact, I was asked to Rand partly because of my 
work in decision theory. When I arrived I read the then 
Top Secret Report R-290 mainly by Albert Wohlstetter. 

At one point in that report, which was written in 1956, 



there is an analysis of the following problem. The 
vulnerability of the retaliatory bomber force depended 
on how quickly it took to the air after an alert. But 
that in turn depended on how quickly an order to take 
off was given after the initial signals had appeared. 

This was a period that had to be measured in minutes, 
since if ballistic missies were on their way the earliest 
possible warning would be 15 to 20 minutes. The question 
became, How soon after the earliest radar warning would 
an order go out to the planes, and then, once having gotten 
the order, how quickly could the force get into the air? 

Wohlstetter pointed out that the planning and the 

calculations of this problem were based on the assumption 

that either the situation was peace-time, in which case 

there were no signals, or else that the president was 

told that there was an attack underway, in which case one 

coul’d ask, physically, how fast would he react to that 

e 

information? But Wohlstetter pointed out that in the 
early minutes of an actual attack, by far the most likely 
situation was that he would not know for certain whether 
he was under attack or not, since the signals would be 
partial and equivocal; you really had to look at his 
decision time in terms of that uncertainty situation. 

Well, this sort of hypothetical problem was 
immediately fascinating to me, because it was essentially 
the subject of my honors thesis at Harvard and later, in 
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more general form, the subject of my Ph.D. thesis. In 

fact, the very summer before, in 1957, at Stanford I had 

been on a Social Science Research Council grant in a 

group studying decision making under uncertainty, at the 

end of that summer (just a month before “th- So\s/e,-t 

XT vis) JV* ‘H-4 1 , 

ICBM test, and the Gaither Report^. So my immediate /e<~Ai~<v fc c* 

> >> 

area where practical problems of the greatest importance ±, 

tr m •**•***•€*■ 

at^€ being formulated in terms that len£ themselves 
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reaction m the summer of 1958 was that I had found an tvw 4 V*-\.o 
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immediately to the abstract analysis that I ka-ve spec 
in. Since that abstract analysis had to do with individual 
decision-making under uncertainty, it lent itself directly 
to problems that focused on decision-making by an individual 
such as the President. In those days, many abstract 
analyses personified an entire nation or strategic system 
such as Russia or the U.S. as a single "player" or 
strategist; that type of analysis was obviously at best 
an extreme simplification, an abstract aid to thought. 

I was particularly drawn to practical problems where one 
realistically was concerned with decisions by a single 
individual; the decisions by the President of the United 
States in his control of nuclear weapons, which by law 
were given exclusively to one individual, were a perfect 
area for me I had been thinking about such problems 
for a number of years. So I gradually made myself very 
expert in the concrete circumstances of these Presidential 
problems. But that in turn required me to be dealing 
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with what were regarded as the highest and most sensitive 
secrets. First, they were within the nuclear strategic 
area; second, they concerned -thee-emreern^d nuclear war 
planning; third, they concerned control in actual nuclear 
war; and fourth, control by the President at the highest 
level. So, by every step, I was led to what we thought of 
as our most sensitive command and control information. 

Now, in the course of my work in the Pacific, I was 
concerned not only with the assurance that we would launch 
our weapons, but with the risk that we would launch them 
on some occasion inappropriately, by a false alarm or 
unauthorized action, and bring about a war in that 
fashion. I became aware of a widespread attitude that 
there did, in fact, exist an agreement between the 
President and unifift^t- commanders that in the event of 
communications failure - which was fairly likely, it 

t 

happened all the time in those days and perhaps still does - 

that a unifi-fi^l commander did have the right to launch 

or even "execute" his vehicles if he had reason to believe 

C 

that a nuclear attack was imminent. The Reorganization 
Act of 1958 specifies a number of "unified or specified 
commanders." "Unified commander" means a theater-type 
commander controlling a number of elements from different 
services, such as CINCPAC in the Pacific, CINCAL in Alaska, 
CINCEUR in Europe (who is also SACEUR for NATO forces, 
i.e., Supreme Allied Commander in Europe). SAC is the only 
"specified" command, a command at that level which has 
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only elements of one service. There were nine of these 
all together, as I remember. Everyone was clear on the 
fact that only the unified or specified commanders had 
the alleged authority .^This was a belief, in the Pacific, 
that clearly contradicted the principle that everyone 
seemed to believe in Washington, that only the President 
could launch or execute nuclear weapons, and that nothing 
had been delegated. No one could point to any basis for 
this in writing, and I came to believe -tkai- probably this 
was a rumor, a myth, that such authorization had been 
given. If so, in its generality and impact it was like 
one that I had encountered when I was a platoon leader 
in the Marine Corps; there was a belief held by all en¬ 
listed men, but known to no officers, that a Bad Conduct 
Discharge could be reversed by evidence of good behavior 
after a year or two when one was out of the service, and 
that therefore a BCD had no real effect on one's later 
employment opportunities or anything else. This belief 
proved to be totally false^ .^et its existence, not known 
to the^Officers,/when I investigated it/)meant that the 
deterrent effect of a threatened BCD was almost nullified. 

In the case of this belief in the Pacific Command, I like¬ 
wise found that the psychological effects of the belief were 
extremely widespread, because it was applied at each level 
of command by analogy to themselves . Since they were all 
"aware" that the unified commander had this alleged 
authorization from the President, they believed that in 
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logical terms it should also apply to them, if they 
were out of touch with their next higher level of command. 
This was discussed quite frankly by a number of people 
at different levels in the following terms: M Yes, of 

course, it's against the book, but. if this were the 

situation...." 

So I came back to Washington with the feeling that 
if the belief were untrue, it was of the highest urgency 
to counteract that belief. And if it were true, on the 
other hand, then special methods were essential to counter¬ 
act the effects of it at lower levels. In fact, I was 
prepared to say that they should consider changing the 
authorization, if it existed, if for no other reason 
than to change the imitation of it at lower levels, 
because that widespread belief seemed absolutely fatal. 

It communicated itself down to every pilot in the world. 

, • f’tcSOfN./ 

This was one of the things, by the way, that made me feel 
the great urgency of getting a physical lock onto all of 
these weapons. 

This was one of the things that I briefed to 
McGeorge Bundy^ fd^aiky-, in that long briefing in February 
1961. The result -er f thtr t- was that Bundy and Harry Rowen 
agreed that this was of great importance to investigate. 
Bundy at that time did not know and was not able to find 
out whether there was such an agreement. He could see 
nothing in the files that indicated what I described, but 
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since it is the practice of departing Presidents to 
take most of their files with them, that look was not 
conclusive. 

(Parenthetically, there let me mention something 
I observed when I happened to be in Washington on a trip 
in December of 1962, just after the Cuban missile crisis, 
while Kennedy was with MacMillan in Nassau discussing 
the termination of the Skybolt contract. Skybolt was an 
air-launched missile that we had agreed to furnish the 
British for use by their bombers; Kennedy had just decided 
not to complete development of it. I dropped in on Adam 
Yarmolinsky in McNamara's office and found him doing a lot 
of telephone calls. He had been called the night before 
from Nassau by Kennedy for a copy of the Skybolt Agreement 
which had been made between Eisenhower and MacMillan. 
MacMillan was claiming that our cancellation of Skybolt 
was a direct contradiction of assurances by Eisenhower 
that if we were to drop the contract we would provide 
money to the British for them to continue their own Sky¬ 
bolt research. This was not Kennedy's belief so he wanted 
to see the exact copy of the agreement. It was discovered 
that only an aide-memoir had been done on the basis of 
Eisenhower's conversation with MacMillan, which had taken 
place with the two of them alone. No one else had been 
present during that conversation, but a subsequent memo 
had been written. No copy of it could be found. The staff 
searched the White House files and they searched the DoD 
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files and the OST files and no one could find a copy of 
any such agreement between the two heads of state. Finally 
it was concluded that Eisenhower had taken it with him 
to the Eisenhower Library, but the person who had called 
John Eisenhower, who was then in charge of the Eisenhower 
Library, was on bad terms with him, and Eisenhower had 
curtly refused to go to the trouble of searching the file 

at that moment to discover the Agreement while Kennedy was 

4 

discussing the matter with McMillan. So Yarmolinsky was 
phoning around urgently, trying to get over this little 
human blockage so that we could get a copy, which they 
finally did get from the Eisenhower Library.) 

At an NSC meeting, McGeorge Bundy announced^a Joint 
White House/DoD Committee of one - namely, Daniel Ellsberg - 
was being formed to investigate the problem of presidential 
authorization of the use of nuclear weapons. I then was 

t 

authorized 
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